What is the CVSS score of CVE-2026-26274?

CVE-2026-26274 has a CVSS 3.1 base score of 6.6 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Is there a patch available for CVE-2026-26274?

Yes, a patch is available for CVE-2026-26274. Update the affected software to the latest version immediately.

October CMS CVE-2026-26274

EUVD-2026-24155 MEDIUM

Incomplete List of Disallowed Inputs (CWE-184)

2026-04-21 GitHub_M

GHSA-h6jm-f4hh-fw27

Information Disclosure October

6.6

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

6.6 MEDIUM

AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch released

Apr 22, 2026 - 21:08 nvd

Patch available

Apr 21, 2026 - 18:01 EUVD

Analysis Generated

Apr 21, 2026 - 17:01 vuln.today

EUVD ID Assigned

Apr 21, 2026 - 16:30 euvd

EUVD-2026-24155

Analysis Generated

Apr 21, 2026 - 16:30 vuln.today

CVE Published

Apr 21, 2026 - 16:16 nvd

MEDIUM 6.6

DescriptionGitHub Advisory

October is a Content Management System (CMS) and web platform. Prior to 3.7.14 and 4.1.10, a vulnerability was identified in the Twig sandbox security policy that allowed database write operations when cms.safe_mode is enabled. Backend users with Developer permissions could use Twig template markup to execute insert, update, and delete operations on any database table through the query builder, which is included in the sandbox allow-list. This vulnerability is fixed in 3.7.14 and 4.1.10.

AnalysisAI

October CMS versions prior to 3.7.14 and 4.1.10 allow backend developers with Developer permissions to bypass Twig sandbox restrictions and execute unauthorized database write operations (insert, update, delete) via the query builder when cms.safe_mode is enabled. This privilege escalation vulnerability enables data manipulation on any database table despite sandbox security policies intended to restrict template functionality.

Technical ContextAI

October CMS implements a Twig sandbox security policy to restrict dangerous operations in template markup when cms.safe_mode is enabled. The vulnerability exists in how the sandbox allow-list configuration handles the query builder object, which is intended for read-only template operations but exposes write methods (insert, update, delete) that can manipulate any database table. CWE-184 (Incomplete Filtering of Information within a Search Result) indicates the root cause involves incomplete enforcement of access controls - the sandbox filters certain Twig functions but fails to restrict the full API surface of the whitelisted query builder component, allowing write operations to bypass intended restrictions.

RemediationAI

Vendor-released patch: October CMS 3.7.14 and 4.1.10. Update immediately to these versions or later. Organizations unable to patch promptly should implement the following compensating controls: (1) Disable cms.safe_mode in production if not required for your deployment - this completely eliminates Twig sandbox attack surface but sacrifices template operation restrictions, increasing risk if untrusted template code is executed; (2) Restrict Developer role permissions to a minimal set of trusted administrators and implement strong authentication (MFA) for backend accounts with Developer access; (3) Audit database access logs and Twig template modifications for suspicious activity; (4) Apply principle of least privilege at the database layer by creating separate read-only accounts for template execution if possible, though this may require October core modifications. The patch should be prioritized as high-urgency given the direct impact to data integrity.